Changeset 5590 in subversion

Timestamp:

Dec 9, 2011 8:50:03 PM (19 months ago)

Author:

thomasb

Message:

Be more strict in style attribute filtering

Location:

trunk/roundcubemail

Files:

• program/lib/washtml.php (modified) (1 diff)
• tests/src/BID-26800.txt (modified) (2 diffs)

trunk/roundcubemail/program/lib/washtml.php

@@ -169 +169 @@
               $value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')';
             }
-            else if (preg_match('/^(http|https|ftp):.*$/i', $match[2], $url)) {
+            else if (preg_match('!^(https?:)?//[a-z0-9/._+-]+$!i', $match[2], $url)) {
               if ($this->config['allow_remote'])
                 $value .= ' url('.htmlspecialchars($url[0], ENT_QUOTES).')';

trunk/roundcubemail/tests/src/BID-26800.txt

@@ -11 +11 @@
 <p>&lt;div&gt; block</p>
 <div style="font-style:italic">valid css</div>
+<div style="color:red; background:url('//somedomain.com/somepath/somefile.png')">
 <div style="{ left:expression( alert(&#039;expression!&#039;) ) }">
 <div style="{ background:url( alert(&#039;URL!&#039;) ) }">
@@ -17 +18 @@
 <p>Inject comment text</p>
 <div style="{ left:exp/*  */ression( alert(&#039;xss3&#039;) ) }">
-<div style="{ background:u/* */rl( alert(&#039;xssurl3&#039;) ) }">
+<div style=" background:u/* */rl( alert(&#039;xssurl3&#039;) ) ">
 
 <h1>4 test</h1>